# agent-permissions.json: declaring what agents may do

> Agent permission model (agent-permissions.json): Declares which actions an agent may take, which are refused, and which need a person.

- Source: /checks/agent-permissions
- Site: AgenticWebScore
- Language: English

---
Declares which actions an agent may take, which are refused, and which need a person. It is the difference between a policy and a wish: in the curated corpus we measured, roughly one site in a hundred publishes one.

| Property | Value |
| --- | --- |
| Check id | `agent-permissions` |
| Dimension | Bot Access Control (18%) |
| Tier | Essential — pool 80 pts |
| Weight inside tier | 3 |
| Impact | Critical |
| Maturity | Experimental — An early convention that may still change shape. |
| Conditional | No |
| Publishing skill | `agent-permissions` |
| Standards | — |

## What the scanner requests

- `/.well-known/agent-permissions.json`
- `/agent-permissions.json`

## What is measured

The scanner requests /.well-known/agent-permissions.json and falls back to /agent-permissions.json, expecting HTTP 200 with a JSON object that maps named actions to a permission decision. It passes when the document declares a default plus at least one allow action and at least one human-approval action, returns partial when it parses and names actions but has no human-approval rule or is only a flat list of action names, and fails when both paths answer non-200 or return a body that is not JSON.

## Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

```bash
DOMAIN="example.com"
for P in /.well-known/agent-permissions.json /agent-permissions.json; do echo "$P -> $(curl -sS -o /dev/null -w '%{http_code} %{content_type} %{redirect_url}' "https://$DOMAIN$P")"; done; curl -sS "https://$DOMAIN/.well-known/agent-permissions.json" | grep -Eo '"(allow|deny|human-approval)"' | sort | uniq -c
```

## The fix

This is the artifact to ship. It is the complete change, not a description of one.

```json
{
  "version": "1.0",
  "site": "https://example.com",
  "updated": "2026-10-08",
  "default": "deny",
  "actions": {
    "read:public-content": { "permission": "allow" },
    "read:pricing": { "permission": "allow" },
    "train:model": { "permission": "deny" },
    "scrape:bulk": { "permission": "deny" },
    "purchase:create-cart": { "permission": "allow" },
    "purchase:pay": { "permission": "human-approval", "note": "A human confirms payment before capture." },
    "account:change-credentials": { "permission": "deny" }
  },
  "contact": "agents@example.com",
  "policy": "https://example.com/ai-policy"
}
```

> No IETF standard defines this filename yet, so the scanner reads exactly the vocabulary this rubric measures: a default plus per-action permission values of allow, deny or human-approval.

## Related checks

| Check | Tier | Impact | Same skill |
| --- | --- | --- | --- |
| `webbotauth` — Web Bot Auth key directory | Essential | Critical | — |
| `ai-rules` — Named AI bot rules in robots.txt | Essential | High | — |
| `ai-policy` — AI usage policy page | Essential | High | — |
| `bot-page` — Crawler and agent policy page | Recommended | Medium | — |
| `security-txt` — security.txt (RFC 9116) | Recommended | Low | — |
| `crawl-delay` — Crawl rate declaration | Emerging | Low | — |
| `ai-txt` — /ai.txt access declaration | Emerging | Low | — |